Top 5 VoIP Vulnerabilities in 2007

Sipera VIPER Lab, operated by Sipera Systems, revealed to Zalud’s Blog the Top 5 VoIP Vulnerabilities in 2007. In assembling this list, the Sipera VIPER team reviewed 2007 vendor and media reports of known vulnerabilities and estimated the impact and potential of each major threat.

1)     Remote eavesdropping of VoIP phone calls, a practice that is exponentially easier in VoIP than with traditional PSTN telephone networks, and which represents a major breach of enterprise communications and security.

2)     VoIP Hopping, one of the enablers of remote eavesdropping, but more critically compromises VLANs, that were previously trusted as providing VoIP security, by enabling a PC to mimic an IP phone so hackers can access VoIP systems.

3)     Vishing, the practice of VoIP phishing, which enables hackers to spoof caller ID and present a fraudulent phone identity, causing some consumers to share sensitive, personal information, such as credit card numbers, with hackers masquerading as banking representatives.

4)     Toll fraud, which allows unauthorized users to access enterprise VoIP networks and make calls, increasing VoIP costs and traffic. While there was a much publicized case in 2006, when the FBI charged two men with accessing VoIP networks and reselling minutes to unsuspecting “customers,” toll fraud continues unabated, especially on VoIP networks with little authentication or call analysis.

5)     The Skype worm, originally known as the w32/Ramex.A virus, spread via IM, which automatically stops access to security tools while it downloads to infected PCs, and changes the Skype user's status to "Do not disturb" so that other users cannot contact the infected user.

“While VoIP and Unified Communication adoption continues to grow, there is unfortunately no corresponding level of VoIP security to comprehensively protect VoIP networks, phones, users and enterprise data. VoIP and cell phone spam only represent the tip of the iceberg for security vulnerabilities, so it’s important to expose these larger threats that emerged and escalated in 2007,” said Krishna Kurapati, Sipera founder/CTO and head of Sipera VIPER Lab. “By highlighting the Top 5 Vulnerabilities, issuing VIPER Lab Threat Advisories, and providing the Sipera IPCS product line, Sipera is helping enterprises and service providers secure their VoIP systems.”